Prescribed supervisory information

Publication date: April 17, 2024

This supervisory policy provides an explanation of the prescribed supervisory information provisions and sets out the Bank of Canada’s expectations for payments service providers’ compliance with non-disclosure requirements related to prescribed supervisory information under subsection 64(1) of the Retail Payment Activities Act and sections 37 to 38 of the Retail Payment Activities Regulations.

Introduction

The prescribed supervisory information (PSI) provisions in the Retail Payment Activities Act (RPAA) and the Retail Payment Activities Regulations (RPAR) designate information that cannot be used as evidence for certain civil proceedings. They also prohibit payment service providers (PSPs) from disclosing certain information that the Bank of Canada provides to them.

This supervisory policy is issued in accordance with section 14 of the RPAA, which authorizes the Bank to issue guidelines for the way the RPAA is to be applied.

What are the restrictions for prescribed supervisory information?

Section 37 of the RPAR provides a list of designated PSI information that is issued or prepared by the Bank of Canada to PSPs. This triggers two restrictions in relation to PSI:

• Under section 64 of the RPAA, PSI must not be used as evidence in any civil proceedings, subject to exceptions under subsections 64(3) to 64(5).
• Under section 38 of the RPAR, PSPs must not disclose PSI, subject to exceptions under subsections 38(2) and 38(3) of the RPAR.

We further explain these exceptions in the next sections.

Why are PSI provisions important?

The restrictions for using or disclosing PSI prevent sensitive information regarding a PSP’s compliance with the requirements under the RPAA or RPAR from being disclosed to third parties. This is regardless of whether the disclosure is in the context of a civil proceeding or a bilateral request from a third party. For example:

• A third party cannot request PSI from a PSP to rely on as part of a legal proceeding, or for reasons of due diligence.
• A third party is not able to compel a PSP to share such information, ultimately preventing the third party from relying on the Bank’s assessment of that PSP rather than conducting its own due diligence of that PSP.
• A PSP cannot publish the findings of its supervisory assessment conducted by the Bank on its website.

These provisions allow for frank and open conversations between the Bank and PSPs throughout their regulatory journey. Establishing and maintaining such frankness between the regulator and the regulated entity are essential for effective supervision.

What is considered prescribed supervisory information?

As it undertakes supervisory activities under the RPAA, the Bank obtains, prepares and produces information, some of which is shared with the PSP. As outlined in section 37 of the RPAR, the following is PSI between the Bank and a PSP:

• any direction, notice, letter, plan, report or recommendation issued or prepared by the Bank in relation to supervision
• compliance agreement made between the Bank and the PSP1
• notice of refusal of a registration application2
• notice of intent to revoke3 and notice of revocation of registration4
• notice of compliance5 (i.e., notice indicating that the compliance agreement has been complied with)
• notice of decision6
• notice of violation7
• notice of default8 (of a compliance agreement under section 76 of the RPAA)
• a Governor’s order9 or a Temporary order10
• any correspondence related to the above information

The following information that the Bank shares with PSPs is not considered as PSI:

• notices related to assessment fees to be paid by a registered PSP as per part 6 of the RPAA
• notices indicating that the Bank has received a complete registration application from an applicant
• notices related to an applicant being granted registration by the Bank

Non-disclosure requirement

As per section 38 of the RPAR, PSPs must not, directly or indirectly, disclose any information deemed PSI with third parties, unless that PSI is published by the Bank of Canada.11 PSPs are responsible for complying with this non-disclosure requirement.

Exceptions

There are two sets of exceptions with respect to PSI.

Exception to the non-disclosure requirement

As per subsection 38(2) of the RPAR, a PSP is permitted to share PSI with the following parties:

• an individual or entity that is affiliated with the PSP, within the meaning of section 3 of the RPAA (e.g., a PSP can disclose PSI with its parent company of which it is a subsidiary)
• directors, officers, employees, auditors, securities underwriters or legal advisors of the PSP or an individual or entity that is affiliated with the PSP (e.g., a PSP can share PSI with auditors conducting a review of its compliance program)

As per subsection 38(3) of the RPAR, a PSP is also permitted to disclose PSI if such disclosures are required by a jurisdiction’s securities laws that are applicable to the PSP. For example, a PSP can share PSI with securities regulators when requested to do so.

Exception to the evidentiary privilege restriction

As outlined in subsections 64(3), 64(4) and 64(5) of the RPAA, PSI can be used as evidence in the following circumstances:

• The Minister of Finance, the Governor, the Bank or the Attorney General of Canada may use PSI as evidence in any proceedings that are in relation to or stemming from activities carried out under the RPAA (e.g., PSI is used as evidence as part of a proceeding in which a PSP makes an appeal to the Federal Court regarding a notice of violation that the PSP has received from the Bank).
• A PSP may use PSI as evidence in proceedings in relation to the administration or enforcement of the RPAA, the Bankruptcy and Insolvency Act or the Companies’ Creditors Arrangement Act (e.g., PSI may be evidence in a PSP’s bankruptcy proceeding).
• A court, tribunal or other body may, by order, require the Minister of Finance, the Governor, the Bank or a PSP to give PSI testimony and documents for proceedings in relation to the administration or enforcement of the RPAA (e.g., the Federal Court may order the Bank to produce PSI in relation to a notice of intent to revoke issued to a PSP).

Differentiating between confidential information and PSI

As per subsection 62(1) of the RPAA, information that the Bank obtains under the RPAA, and any information prepared from that information, is confidential, requiring the Bank to treat it accordingly. This is not to be confused with the restrictions in relation to PSI, which are applicable to select information that is prepared and sent by the Bank to a PSP. The PSI restrictions do not prohibit PSPs from sharing their own confidential information with third parties; for example, if PSPs share data with the Bank, they can share the same data with other third parties of their choosing.